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Six faotors which have important influence 
on the design of flight stabilization and 
control systems for manned spacecraft are dis- 
cussed* The factors considered are* type of 
vehicle, size of crew, time of mission, weight 
of vehicle, purpose of mission, and equipment 
thermal control concept* Following the dis- 
cussion of the general influence of eaoh factory 
descriptions of flight stabilization and 
control systems for the current manned space 
programs are presented and some important 
effects of the various factors are noted* 

Block diagrams of the several systems and 
significant photographs of flight control 
hardware are presented* 

Introduction 


In common with all other complex devioes, 
flight stabilization and control systems for 
manned spacecraft are the result of a myriad 
of compromises, each of which can be traoed to 
some recognizable factor or design requirement* 
All these faotors are probably not recurrent 
and thus will differ for eaoh system consid- 
ered* Therefore this paper will not attempt 
to consider all the factors which may affect a 
flight stabilization and oontrol system designj 
rather, a set of six factors has been selected 
on the basis that each of them is of some 
importance in all instances, and further that 
these six faotors will largely determine the 
functional and hardware design concepts* 

This paper is divided into two major 
sections. The first section discusses the six 
selected factors and presents generalized 
examples of their separate influences; the 
second section contains a description of each 
U*S« manned spacecraft flight stabilization 
and control system and points out features in 
their design which are attributable to these 
six factors. (Hereafter, "flight stabiliza- 
tion and control system" is frequently abbre- 
viated to "oontrol system.") 

Discussion of Influential Factors 


superorbital flight path. Also, a Mercury 
capsule can re-enter from a superorbital path 
with the same control system that was used in 
the first TJ*S. manned suborbital flight. Con- 
versely, however, there is a marked difference 
between the control requirements for the X-20 
and Mercury regardless of the flight path 
specified* 

On this basis, then, the vehicle exterior 
geometry (and to some extent structural char- 
acteristics) will influence control system 
functional design for both free space, exit, 
and re-entry mission phases* The vehicle 
geometrical configuration and center of 
gravity location will determine whether the* 
flight within a sensible atmosphere will be 
ballistic or aerodynamic and whether the 
vehicle will be statically or dynamically 
stable. The structural characteristics will of 
course determine whether there is a problem of 
structural frequencies coupling with the 
control system. 



Figure 1. Types of Orbital and Re-&itry 
Vehicle Paths 


Type of Vehicle 

One of the most baslo factors affecting 
oontrol system design is the type of vehiole 
to be controlled. Manned spacecraft can be 
classified according to the type of flight 
regime, that is, suborbital, orbital, or 
super orbital. (See Figure 1.) However, study 
of the correlation of control requirements 
with these three regimes indicates that very 
little correlation exists. For example, a 
vehicle of the X-20 Qfciia-Soar) type will have 
much the same control requirements regardless 
of whether it is launched into a suborbital or 


In general it can be said that the pro Diem 
of re-entry control increases in complexity as 
the L/D (lift-to-drag) ratio is raised from 0 
to 2 or 3 and as the configuration changes 
from a blunt body of revolution to a winged, 
airplane-like shape. Several items contribute 
to this Increase in complexity; for example, a 
nonlifting body does not necessarily need roll 
attitude control, but roll attitude must be 
controlled or modulated in a lifting body in 
order that the impact or landing area can be 
even approximately predicted. In like manner, 
pitch and yaw attitude oontrol requirements 
are much less stringent on the nonlifting body 




■because of the lack of changes in transverse 
foroes with angle of attack. 

Figure 2 presents an example of the manner 
in which the geometric configuration affects 
the vehicle stability characteristics. Typieal 
statio stability plots are given for a low L/D 
(<0.5) blunt body and for a high L/D 
(2<L/D<3) re-entry configuration. It is 
readily apparent that the blunt body has much 
less variation in static stability over the 
Mach number range and thus will require a less 
sophisticated oontrol system; in fact it is 
probable that a satisfactory re-entry could be 
accomplished with a rate damping system alone 
and that a safe re-entry could be made in an 
emergency without even the damper. 



Figure 2. Comparison of Static Stability 
Characteristics of Nonlifting and Lifting 
Re-Entry Vehicles 

When over-all vehicle stability is con* 
sidered from the pilot* s viewpoint, that is, 
in terms of flying qualities, the need for 
more augmentation on the high L/D vehicle 
becomes even more evident. One version of 
longitudinal handling qualities requirements 
is presented in Figure 5* In this figure the 
shaded area represents the characteristics 
whioh unaugmented, high L/D re-entry vehicles 
exhibit for various flight conditions. It can 
be seen that there is a definite need to alter 
both the frequency and damping in order to 
move all the flight conditions represented 
into the desirable area. (See reference 1.) 
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Figure 3- Handling Qualities in Pitch (u> - 
frequency of motion, £= damping factor) 

These considerations lead to the following 
conclusions: 

1. A nonlifting or low L/D vehicle will 
usually require only simple fixed-gain damping 
and low-precision attitude control. This 
oontrol can and usually must be supplied by 
on-off reaotion jets which allow the use of 
simple driving electronics. 

2. A high L/D re-entry vehicle must have 
variable-gain damping said precise three-axis 
attitude control. Control is usually obtained 
by means of proportionally actuated aerodynamic 
surfaces. The control and actuation require- 
ments generally call for the use of complex 
and precise electronics. The vehicle may be 
uncontrollable without automatic oontrol so 
that great emphasis must be placed on high 
reliability. Such reliability will generally 
require parallel active redundancy {as indi- 
cated below under Time of Mission ), which will 
further increase the electronic complexity. 

Size of Crew 


In addition, the basic fact that the high 
L/D vehicle generates an increasing amount of 
lift (until L - W) during re-entry means, as 
mentioned above, that the magnitude and 
orientation of the lift vector must be closely 
controlled. This in turn requires that the 
pilot or the control system must hold roll and 
angle of attack (or perhaps pitch attitude) 
within close tolerances in order to follow a 
given flight path and prevent the onset of 
dangerous aerodynamic forces or heating. 


The effects of crew size on control system 
design can be illustrated by the summarized 
results of a human factors study of a plane- 
tary exploration vehicle based on the bus 
lander concept. The study is based on the 
methods outlined in references 2 and 3* 

The curves shown in Figure 4 represent the 
various crew requirements assuming different 
levels of system automaticity, for a planetary 
orbit phase of a planetary landing mission. 

The number of active crew members is plotted 
against the time from planetary orbit injec- 
tion. 
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Figure 4. Effect of Crew Size on Automation 
Requirements 


The "three -man" level is shown as the 
vehicle design limit. This three-man crew 
limit assures active participation of the 
crew at all levels of system performance: 
decision making, dynamic control, monitoring, 
checkout, replacement, and repair. 

The design goal line at the "two-man” 
level represents the crew requirement for a 
semi-automatic system in which failures do 
not occur. This reflects a system philosophy 
of active crew participation at such a level 
that the equivalent of one operator as a 
"human spare" is available to achieve the 
necessary total system reliability. 

The remaining curves are based on the crew 
tasks that are anticipated for the planetary 
orbit phase : 

1. The co mman der of the vehicle is 
primarily concerned with command decisions, 
orienting and stabilizing the vehicle, 
stabilization and control system checkout, 
communications, equilibrium and dynamics 
monitoring, and planetary surface operations. 

2. The navigator is occupied with sub- 
system alignments and gathering data for 
navigational position and orientation when he 
is part of the crew of three. He is also 
occupied with orbital correction, system 
monitoring, and communication when he is alone 
during orbit. 

3. The systems engineer will be responsi- 
ble for subsystem monitoring, trouble-shooting, 
and maintenance tasks. 

The execution of all these tasks has been 
plotted against time in the upper curve of 
Figure 4 to indicate the number of crew 
members needed to carry out the work in the 
case of a hypothetical fully manual system. 

The requirement of a crew in excess of five men 
is evident during four periods of the orbit. 
This occurs because the execution of complete 
manual checkout procedures of all subsystems is 
very time consuming, and therefore many men are 
required to complete these tasks within the 


allotted time. Other tasks, such as star 
sighting, position, and position error calcula- 
tions, would also be time prohibitive without 
the benefit of a high-speed digital computer. 

At the other extreme, the fully automatic 
system with a crew requirement of one man is 
plotted in the lower curve of Figure 4* This 
curve represents a hypothetical system with 
automatic monitoring and control so that the 
single operator is more of a passenger than a 
participator in system functions. His indi- 
cated partial activity at either end of the 
plot represents near-body observations, 
communication with earth, and a low- level of 
system monitoring activity. The operator 1 s 
full activity in the central portion of the 
plot represents his scientific and exploratory 
activities on the planetary surface. 

The middle curve of Figure 4 represents the 
crew requirement for a system which is 
believed to represent a practical compromise* 
This realizable concept does not have the 
drawbacks of the excessive number of crew 
members of the fully manual system, nor is it 
as technically prohibitive as the fully auto- 
matic system. Rather, it is structured to 
utilize the intelligence and unique adapta- 
bility of the crew members working integrally 
with the advanced automatic subsystems which 
are designed to complement the crew’s possible 
contributions and thus maximize mission 
success probability. This semi-automatic 
system plot is a composite of the proportion 
of each crew member’s total capability which is 
required for the particular tasks assigned to 
him during this mission phase. This plot 
includes manual control of the orbiting bus 
and the lander as well as monitoring, trouble- 
shooting, and subsystem maintenance. 

During a portion of the planetary orbit as 
sole occupant of the complex bus, the naviga- 
tor will play a triple role by spending his 
waking time in continuous monitoring and 
maintenance of his system, supervising vehicle 
control, and solving his customary navigation 
problems. Meanwhile, the descent, planetary 
operations, ascent, rendezvous, and docking of 
the lander fully occupy the abilities of the 
pilot and systems engineer. 

One conclusion that can be drawn from such 
studies is readily apparent in a gross sense, 
namely, that crew size can be decreased as 
automaticity is increased and crew work load 
is consequently decreased. This factor, 
however, is interdependent with others. For 
example, the cost and development time for a 
fully automatic control system might dictate 
the semi-automatio approach even though the 
required reliability could be attained in the 
automatic system. 


Time of Mission 

The design mission duration becomes an 
important factor in the design of flight 
control systems because of the interrelation 
of mission duration with the probability of 
successful operation of any of the various 
vehicle subsystems. Figure 5 presents four 
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Figure 5. Effect of Redundancy on Equivalent 

MTBF 


curves for various control system configura- 
tions ("configuration" here meaning the type 
and extent of redundancy employed). The curves 
are drawn with an ordinate of equivalent mean- 
time-hetween-failure (MTBF) and an abscissa on 
a log scale of total mission time, "Equivalerfc 
MTBF" as used here for redundant systems is 
that MTBF which would be needed in a non— 
redundant system to achieve the same reli- 
ability for a given mission time. The four 
curves represent i 

1, A redundant system having one active 
channel with another identical active ch ann el 
being maintained in standby condition (curve 
1). In considering this system it is presumed 
that the pilot will be able to detect a 
failure of the active system and manually 
switch to the standby system. 

2. A redundant system having two parallel 
active channels each equipped with independent 
monitors that can determine and switch out a 
malfunctioning channel (curve 2). 

3 * A redundant system having three 
parallel active channels equipped with com- 
parators which conduct a continual two-out-of- 
three vote and switch out any disagreeing 
channel (curve 3)* 

4 . A single channel non-redundant system 
having a mean-time-be tween-failure as deter- 
mined by piece-part failure rate of 1,000 
hours (curve 4), 

Some interesting general conclusions can 
be drawn from an examination of these curves. 
First, it becomes evident that for long 
mission times, particularly above 1,000 hours, 
the efficacy of redundancy in increasing the 
equivalent MTBF is sharply reduced. In fact, 
configuration 3* the two-out-of— three voting 
system, aotually exhibits a lower equivalent 
MTBF than the single non— redundant system for 
all mission times above 693 hours. Secondly, 
the greater effectiveness of the active- 
standby arrangement of configuration 4 
indicates that it is by far the most 
effective approach whenever this arrangement 
is feasible from a safety standpoint (that is, 
where the pilot will have time to detect and 
switch out the malfunctioning channel). 

Looking now at the low end of the 
abscissa scale, it can be seen that any of 
the three types of redundancy shown 
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contributes large increases in equivalent MTBF 
for short mission times. In fact, the numbers 
indicated for mission times below 50 hours 
become quite large and in effect almost 
eliminate a redundant flight control system as 
a probable cause of mission abortion. 

By recalling some of the characteristics 
mentioned above in connection with lifting 
re-entry vehicles, it can be inferred that 
either configuration 2 or 3 would be particu- 
larly applicable to this type of vehicle 
because of the severe controllability problems 
whibh might occur while a pilot was detecting 
and switching out the failed control system 
channel. This need for instant switch-over 
would probably be a critical factor in the 
choice of a control system for a lifting 
re-entry vehicle even though the mission length 
might be sufficient to severely limit the 
equivalent MTBF obtainable. One solution to 
this problem would be to cor cine the active 
redundant and the standby arrangements in such 
a way that during extended orbital or deep- 
space flight the system would function as an 
active-standby system, but during re-entry it 
oould be converted to an active two or three 
channel system. 

Returning now to the high end of the mission 
time scale, it is evident that as the mission 
time becomes appreciably greater than the 
single-channel MTBF, all forms of redundancy 
lose effectiveness. It thus appears that 
missions with lengths measured in months and 
years rather than hours and days will require 
onboard repair or perhaps a much more conserva- 
tive approach to the design of both moving-part 
mechanisms and active electronics in order that 
the MTBF values may approach the numbers 
associated with current telephone or utility 
equipment • 

In any event it can be seen that the 
mission duration and the feasibility of in- 
flight component replacement combine to almost 
dictate the type of redundancy approach to be 
used. The only prospect of altering this 
situation will be through the use of flight- 
worthy components which have reliability 
increased by one or two orders of magnitude. 

Purpose of Mission 

The mission purpose of a manned space 
vehicle will influence chiefly the functional 
design aspects of the control system. For 
instance, consider Mercury and Gemini. Project 
Mercury provided an orbital vehicle which could 
carry a man for a limited number of orbits. 
Gemini has a broader mission purpose. In 
addition to the orbit phase, which is 
considerably longer than that for Mercury, 

Gemini is also required to accomplish orbital 
rendezvous. It is the addition of the 
different purpose, namely rendezvous, that 
causes the functional design of the Gemini 
control system to differ appreciably from that 
for Mercury. This is not to say that all 
internal functions of the control system are 
handled in a similar manner in the two systems 
and that the only differences are due to the 
rendezvous requirement. This is not the case. 
Gemini employs all solid-state signal switching. 



does not use sector switches on sensors, and in 
general uses more advanced mechanization 
techniques. These differences, however, are 
not due to the functional requirements as 
created by the mission purposes, but rather 
to the advance in the state of the control 
art from the time the Mercury program started 
until the time the Gemini program started. 

Extending the comparison further we can 
look at Apollo and Mercury. Apollo does have 
orbital flight as part of its mission purpose. 
However, orbital flight for Apollo represents 
only a small portion of the many flight con- 
ditions that must be encountered, and thus the 
portion of the Apollo control system that is 
necessary for orbital flight comprises only a 
small portion of the entire Apollo stabiliza- 
tion and control system. The larger portion 
is concerned with coasting attitude hold, 
velocity corrections, and rendezvous 
maneuvers. Each of these mission requirements 
creates the need for some additional hardware 
to fulfill the function and thus the complex- 
ity of the mission has a rather direct effect 
on the complexity of the control system. 

If we look now at a vehicle of a basically 
different type, such as the X-20, we notice 
even more marked differences. Superficially 
it may seem that the mission purpose of the 
X-20 is quite similar to that of Mercury in 
that both are intended to go into orbit for 
a short period of time and then accomplish a 
safe re-entry. Both are intended to be 
controllable by the human pilot but both are 
also designed to accomplish a completely 
automatic re-entry. Here the similarity stops. 
Mercury accomplishes its re-entry along a 
ballistic and almost uncontrolled path 
utilizing a blunt body and heat shield to 
survive the aerodynamic heat encountered. 

The X-20, on the other hand, is to accomplish 
its re-entry by gliding into the atmosphere 
as a winged vehicle and thus it is subject, 
as described above, to all of the stabiliza- 
tion and control problems common to low aspect 
ratio high-speed aircraft. In addition it 
must follow a fairly narrow descent corridor 
in order to avoid intolerable aerodynamic 
heating. Thus it is in the differences of 
the mission purpose In regard to re-entry 
that Mercury and the X-20 differ; insofar as 
orbit phase is considered, the control systems 
for each are functionally somewhat similar. 

As a final example, let us consider the 
problem of a manned orbiting spaoe station. 
Here the purpose of the mission is not merely 
to accomplish manned orbital flight and 
re-enter safely but to provide an orbital 
laboratory in which men may work productively 
for Weeks or months at a time. This change 
in purpose— from a short duration mission 
with a pilot aboard to control the vehicle to 
a long duration mission in which the vehicle 
is largely expected to control itself and 
thus allow the crew to conduct experiments— 
calls for a completely different functional 
design of the vehicle stabilization and 
control system. As mentioned below in the 
section on manned space stations, there are 
three or perhaps four completely different 
oontrol functions required for an orbiting 


laboratory as compared with a Mercury type 
vehicle. 

Thus far some illustrations have been 
given of how the control system functional 
design must incorporate all the features 
necessary to allow the vehicle to fulfill 
its mission. In the reverse sense it is 
equally important that the control system, and 
for that matter all other systems, be designed 
to accomplish the mission purpose and nothing 
more. The reason for this is fairly obyious. 
Every pound put into orbit or accelerated to 
escape velocity costs hundreds of thousands 
of dollars, and to needlessly add a few pounds 
of weight to a space station control system in 
order to make it hold attitude closer than 
required is to needlessly spend several 
hundred thousand dollars for each vehicle 
placed into orbit. 

Weight of Vehicle 

The effect of vehicle weight on the flight 
control system design is perhaps an inverse 
type of factor. That is, a heavier vehicle 
does not necessarily require a heavier or more 
complex control system, but rather the heavier 
vehicle may permit the use of a heavier 
control system* A comparison of the ratio of 
vehicle weight to control system weight for 
the current manned space vehicles shows for 
Mercury - 80:1, for Gemini - 200:1, for Apollo 
- 128:1, and for the X-20 (Dyna-Soar) - 112:1. 

A consideration of the reasons contributing to 
the differences in this ratio brings out the 
following items : 

1. The two vehicles with the most similar 
missions are Mercury and Gemini. Here the 
decrease in relative control system weight can 
be attributed almost completely to the use of 
more advanced sensors and electronic 
components. In the case of Mercury, as is 
described below, it was necessary to use 
existing state-of-the-art components in order 
to meet the time and reliability requirements 
of the program. Gemini came almost three 
years later and, while it too is a program 
not allowing extensive new component develop- 
ment, the advance in the state-of-the-art 
since the beginning of the Mercury program 
allowed the Gemini control system to weigh 
only slightly more than one— half the Mercury 
control system. The increase in Gemini system 
complexity caused by the added rendezvous 
mission requirement was probably largely 
offset by the reduction in automatioity 
compared to Mercury. 

2. Looking now at the ratios for Apollo 
and the X-20, it can be seen that they are 
reasonably close together. The proportion of 
control weight to vehicle weight is about 
two-thirds of that indicated for Mercury. 
Inasmuch as both the Apollo and X— 20 are 
considerably more complex than the Mercury 
system, it is apparent that the smaller 
relative weight of the control system must be 
due to the larger vehicle gross weight and the 
more advanced components and packaging 
techniques used in the Apollo and X— 20 control 
sy sterna. 


3. If the weight of the Apoilo control 
system is compared to the total gross weight of 
the trans lunar vehicle rather than to that of 
the Command Capsule alone, the ratio will be 
almost 700:1. This illustrates an important 
trend for future vehicles, namely that as the 
vehicle gross weight increases, the relative 
control weight decreases and thus becomes a 
less critical factor in buildup of vehicle 
weight. This will allow greater use of 
redundant channels and derated components, thus 
making possible the reliability that will be 
required for deep-space voyages. 

The over-all effect then of an increased 
vehicle weight (or a decrease in control weight 
due to more advanced components) will be to 
allow more freedom in the functional design of 
the control system. This freedom will un- 
doubtedly be used in improving performance and, 
even more important, in employing advanced 
multiple-channel redundancy techniques to 
improve mission reliability. 

Equipment Thermal Control Concent 

General Considerations .- The choice of a 
thermal control concept for the control equip- 
ment in a manned spacecraft is quite often 
determined by the seemingly unrelated factor of 
equipment location. That is, is the equipment 
located in a pressurized or unpressurized area? 
This is quite important because, with the 
current trend toward a comfortable, air-condi- 
tioned, shirtsleeve cabin environment, equip- 
ment in the pressurized area can operate under 
what is often referred to as room temperature 
laboratory conditions. Thus air is available 
for removing electronic equipment waste heat 
as long as the vehicle remains pressurized. 

Such waste heat can be added to the air by 
forced convection through the devices. 

If for some reason the air pressure is 
lost, equipment waste heat must be dissipated 
to the equipment mounting structures and 
surroundings by conduction and infrared radia- 
tion. Unless equipment power levels and duty 
cycles are extremely low, excessive piece-part 
temperatures can result and equipment, life may 
be severely reduced or terminated. Many de- 
vices can survive indefinitely under condi- 
tions of mounting surface conduction and infra- 
red heat transfer if they are provided with 
external package surface area proportional to 
the internal heat generation rate. For 
example, neglecting conduction into the 
vehicle air frame, on the order of 10 watts 
per square foot can be dissipated from the 
surface of a device without exceeding 180°F 
component temperatures (for 140°F ambient). 

For equipment with greater unit area heat 
flux, piece-part temperature may become ex- 
cessive after loss of pressure so that opera- 
ting life will be reduced. For earth orbit- 
ing spacecraft this condition need not be 
catastrophic because the thermal capacity of 
the equipment package and its mounting can 
absorb enough heat to prevent immediate 
damage. For a well-designed package, an 
operating time of 30 to 90 minutes is usually 
available after depressurization, and during 
this period the spacecraft can leave orbit, 
re-enter, and land. 
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If for various reasons the equipment is 
located outside the pressured area, it must 
usually be provided with a heat sink into which 
heat can be discharged by conduction. There 
can be an appreciable amount of cooling by 
radiation alone, but this is sufficient only 
for very low power dissipation devices. The 
amount of radiation occurring will not usually 
be sufficient for the average device and 
care must be taken to ensure adequate heat flow 
from all components to eliminate hot spots. 

The heat sink is usually a metal-to-liquid heat 
exchanger to which the chassis is attached. 

The hot liquid is either circulated through an 
external space radiator where heat is radiated 
to space (Gemini and Apollo) or the liquid may 
be ejected overboard (Mercury). 

The liquid heat exchanger approach 
eliminates the problem of equipment heat dissi* 
pation during depressurization and also may 
have advantages during normal vehicle condi-. 
tions. Studies show that most manned space 
vehicles in near-earth orbits or greater than 
approximately 0.8 astronomical units from the 
sun will require heating to maintain air 
temperatures between 70 and 80 *F. Thus, it may 
be necessary to obtain heat from electronic 
equipment and add it to the air in various 
compartments where it is lost through the 
vehicle walls. 

Selection of Component Packaging Scheme .* 
When the factors affecting thermal design of 
the equipment have been defined and con* 
strained, a component packaging scheme must be 
selected which is compatible with the other 
aspects of equipment design, such as electronic 
performance, vibration, and shock. Selection 
of the thermal packaging scheme is based on 
realizing component temperatures commensurate 
with mission reliability and minimum package 
mass. Detailed calculations are made for 
component temperatures, based on the thermal 
environment and component heat dissipation. 
Digital and analog computer techniques can be 
employed for prediction of component tempera** 
tures. These analyses show problem areas 
which must be resolved by design modification. 

In convection-cooled electronic equipment, 
problems occur with components whose internal 
heat generation is large compared with 
envelope area available for heat transfer. 
Additional metal must be used to spread waste 
heat over greater area. Heat transfer 
coefficients on the order of 10 BTU per square 
foot-degrees F are attainable in convection- 
cooled packages at one atmosphere air pressure. 
For a typical power transistor, the resulting 
thermal impedance between the envelope and the 
air stream is approximately 12 *C per watt. If 
this impedance is too great, the component 
must either be mounted on a metal chassis ox 
must be attached to a separate finned 
assembly. The latter approach is less 
desirable because it requires addition to the 
package mass without increase in the package 
structure. In the case of large complex 
packages it is often necessary to employ a 
"cut and try" approach in order to obtain 
desirable component temperatures with a 
minimum of cooling air flow. 


The internal design of packages cooled "by 
conduction to a heat sink involves sizing of 
thermal conduction paths from components to 
the package mounting surfaces $ however it is 
also important to consider internal infrared 
radiation from the components* For example, a 
4 by 5-inch circuit board spaced 5/4 inch on 
each side can dissipate approximately two watts 
with components at 180 °F and surroundings at 
140 °F* Many switching and logic circuits have 
heat dissipation within two watts and thus no 
conduction heat transfer paths are necessary to 
prevent excessive piece-part temperatures* 

There are several general approaches to be 
considered in the design of conduction-cooled 
packages. One approach is to sort out the 
piece-parts with high internal generation (such 
as power transistors, resistors, zeners, diodeg) 
and mount these directly to the metal chassis* 
The remainder of the components could then be 
mounted directly on epoxy component boards or 
in open or potted welded modules. 

In circuits where the majority of piece- 
parts generate a large amount of heat (one 
watt and up) and are also of large size, epoxy 
card mounting is generally undesirable for 
structural and thermal reasons. In this case, 
metal chassis mounting is the best approach. 

In circuits where piece-parts generate 
between zero and 1.5 watts and are of small 
size, it is possible to mount all components 
in open or potted welded modules which are 
attached to composite aluminum and epoxy 
boards. During equipment operation in high 
vacuum (greater than 10“4 torr), heat conduc- 
tance across interfaces is greatly reduced 
unless interface pressures are kept high 
(greater than 50 to 50 psi). Bolted, welded, 
or glued joints must be used in packages 
designed for steady-state space operation. 

One interesting general conclusion can be 
drawn from Honeywell* s experience in thermal 
design of hard-mounted electronic equipment. 
For either convection— cooled or conduction- 
cooled packages, stress and shock considera- 
tions, not thermal considerations, determine 
cross-sectional areas and surface areas of 
metal chassis parts. As a rule, therefore, 
good thermal design can be added to a package 
with little or no increase in package weight 
or volume. 

Examples of Current Manned Spacecraft 
Control Systems 

Mercury Automatic Stabilization and Control 
System 

The first United States manned spacecraft 
program was conceived and carried out in an 
atmosphere of urgency, with no background of 
direct experience, and with deep concern for 
flight safety. Under such circumstances, the 
Mercury Automatic Stabilization and Control 
System (ASCS) was the result of conservative 
and proven design principles to minimize 
operating risks and development time. 

A major portion of the ASCS was designed 
by Honeywell under contract from McDonnell 


Aircraft Corporation. Certain components of 
the ASCS, such as the horizon scanners and the 
reaction jet system, were developed by other 
companies under McDonnell contracts. 

Functional Requirements .- Because man*s 
ability to perform in space was not completely 
understood before the Mercury flights, the ASCS 
had to be fully automatic, that is, capable of 
performance throughout the entire mission 
profile without astronaut assistance. 

Reliability was therefore the important design 
objective, since the ASCS is the primary system 
for Mercury capsule attitude control. Other 
major design constraints were minimum weight, 
minimum power consumption, and maximum use of 
previously developed and proven hardware. 

The ASCS (Figure 6) consists of attitude 
reference components, rate sensors, logic 
electronics, and suitable displays. It is 
designed to sense spacecraft attitudes and 
rates and send signals to the control jets to 
maintain the desired attitude or to change from 
one attitude to another. Automatic, semi- 
automatic, and manual control may be selected 
for any or all of the three axes, and 
simultaneous operation of manual and automatic 
control is also possible. The functional 
requirements of the ASCS are best described in 
terms of six operating modes: 

Rate Damping - Reduce pitch-yaw rates from 
50 degrees per second (or less) to 0.8 degree 
per second within five seconds. Reduce roll 
rate from 10 degrees per second (or less) to 
0.8 degrees per second within five seconds. 

Orientation - Perform 180-degree yaw 
maneuver and position capsule in pitch to 
commanded attitude of 14 degrees. Hold 
commanded attitude in each axis within five 
degrees . 

Orbit - Maintain attitude in each axis 
within five degrees. 

Retrograde - Position capsule to retro- 
grade pitch attitude of 54 degrees. 

Post-Retrograde - Position capsule in pitch 
to re-entry attitude (one degree down) and 
maintain attitude in each axis within five 
degrees • 

Re-Entry - Upon sensing 0.05-g deceleration, 
maintain pitch-yaw rates of less than 0.8 
degree per second. Establish and maintain 
constant roll rate of 10 to 12 degrees per 
second. 

Mechanization .- Two unfloated two-degree- 
of-freedom displacement gyros are used for 
attitude reference. The roll-pitch gyro is 
used as a vertical gyro with its spin axis 
aligned to local vertical. The roll-yaw gyro 
is used as a directional gyro with its spin 
axis aligned perpendicular to the orbital 
plane. The vertical gyro gimbals are slaved 
to periodic horizon scanner signals for long- 
term vertical reference. V/hen the horizon 
scanners are not energized, a signal propor- 
tional to orbital rate is used to orient the 
vertical gyro in pitch. 


Three rate gyros are provided in the system, 
each having outputs at discrete rates rather 
than proportional rates* These gyros are used 
for control in the damper and re-entry modes 
and are used with attitude error signals to 
command the switching logic in the orientation, 
retrograde, and post-retrograde modes. The 
rate gyros are not used during orbit mode. 

The major electronics unit of the ASCS, 
known as the amplifier-calibrator, contains 
four major sections: mode logic, gyro slaving 
loops, attitude repeater servos, and control 
logic. The amplifiers and logic systems use 
solid-state devices throughout and approxi- 
mately 500 diodes and transistors are 
required. 


The mode logic responds to input commands 
and places the ASCS in an appropriate mode of 
control. The attitude repeater servos take 
the attitude gyro output signals representing 
pitch, roll, and yaw angles and drive multiple 
outputs: sector switches for control logic, 
potentiometers for telemetry*, and synchro 
repeaters for attitude indication to the 
astronaut. 


The control logic, which is mechanized by 
transistor and diode circuits not critically 
dependent on voltage, receives the step 
function outputs of the attitude repeaters and 
the discrete rate signals from the rate gyros. 
Using these step indications of attitude and 
rate conditions, along with the output of the 
mode switching logic delivered by the current 
ghase of the mission, "decisions" are made 
which result in actuation of appropriate 
reaction control valves. 

The attitude and rate gyros are examples 
of previously developed hardware which was 
adapted on short notice for use in Mercury, 

The gyros were originally designed for 
operation in autopilots of high-performance 
aircraft. To meet Mercury requirements, the 
vertical gyro v;as equipped with a heavy metal 
rotor to decrease drift rate by increasing 
rigidity. By minimizing gyro drift rate, the 
number of horizon scanner slaving periods 
could be reduced, thus conserving spacecraft 
power. Special high-temperature lubricants, 
wire, and insulation had to be provided in the 
attitude and rate gyros to ensure operation 
for extended periods at zero pressure without 
benefit of external cooling. 
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Figure 6. Mercury Automatic Stabilization and Control System 








Although weight, space, power, and 
development tine all prevented the use of 
functional redundancy in the ASCS, several 
design considerations are worth noting: 


1. The digital nature of the control 
logic provides a degree of redundancy "because 
the orbit attitude is maintained within 
desired limits by a series of five sector 
switches for each axis, Each switch backs up 
the previous one so that failure of any single 
switch will result in only minor variations 
from the normal limit cycle, 

2, the various modes of operation are 
also arr-ui ed to back ur other nodes. Thus, 
if for any reason orbit mode cannot be 
maintained, the system switches into 
orientation mode* This has actually 
happened on several flights because of mal- 
functions of some of the small jets used for 
orbit mode control. 

Another form of redundancy is shown by 
the use of both horizon scanners and attitude 
yros . Early flight tests indicated that the 
horizon scanners, although performing reliably, 
sometimes mistook high altitude clouds and 
hurricanes for deep space and therefore 
provided an erroneous attitude reference. 

These effects are not serious when the gyros 
are slowly torqued to the scanner reference, 
but could be annoying if the erroneous signals 
were used directly for control logic informa- 
tion. Later design changes have improved the 
horizon scanner * s operation. 


Environment al Factors .- Extensive out- 
gassing precautions were observed because the 
ASCS equipment is located in the capsule with 
the astronaut. The paint and varnish used in 
all ASCS components was specifically designed 
to meet rigorous nontoxicity requirements. An 
epoxy coating which is nontoxic under condi- 
tions of high temperature and low pressure was 
developed for humidity and salt spray protec- 
tion. Special nontoxic hookup wire is used 
throughout the Mercury equipment. 

The 100 per cent oxygen atmosphere 
requirement necessitated the enclosure of all 
components with switching contacts and special 
selection of materials which are inert to 
oxygen. 

Launch vibration and acceleration presented 
no difficult problems to the ASCS design since 
similar gyros and electronics had performed 
well under severe aircraft testing. All 
electronics except the attitude repeater 
circuitry is hard-mounted in the capsule. 

No special heat transfer methods are 
provided in the Mercury capsule for ASCS 
equipment. To ensure operation under the zero 
pressure requirement, the equipment is 
designed with.-a maximum number of conducting 
paths from heat generating elements to 
minimize hot spots and to use the entire 
package structure as a heat sink. 


Reliability of the ASCS has been excep- 
tionally good on all flights with no control 
system failures to date. This result has thus 
verified the wisdom of the conservative design 
approach for the Mercury program. 

Gemini Attitude Control and Maneuver 
Electronics 

The primary objectives of Project Gemini 
are (l) to provide early manned rendezvous 
capability by development of rendezvous 
techniques and (2) to provide long-duration 
manned flight experience to evaluate man*s 
performance capabilities under prolonged 
periods of weightlessness. These objectives are 
clearly different from Project Mercury, and the 
design of the Gemini flight control system 
reflects this difference. 

McDonnell Aircraft Corporation determined 
the Gemini control system functional design, 
and Honeywell implemented and mechanized the 
functional design of the Attitude Control and 
Maneuver Electronics (ACME). 

Functional Requirements . - Mercury 
experience has demonstrated that man is highly 
capable of exercising control techniques in an 
orbiting spacecraft. The Gemini control system 
is therefore not fully automatic. Selection of 
control modes is required of the astronaut 
since a programmed sequence of modes will not 
be used. Because the Mercury control system 
was designed for automatic operation about 
particular set points, it is limited to 
particular attitudes which can be maintained. 

The Gemini control system is much more versatile 
because it has a pseudo all-attitude hold mode 
with capability of holding attitude rate to less 
than 0.1 degree per second. 

Mission durations up to two weeks dictate 
the heavy emphasis placed on low power consump- 
tion, light weight, and high reliability in the 
design of the control system. The study of 
rendezvous techniques places an additional 
heavy emphasis on control system performance. 

The ACME functional design requirements are: 

Automatic Attitude Hold - Maintain space- 
craft attitude within one degree of the attitude 
reference supplied by the inertial platform, 
radar system, or computer. Maintain spacecraft 
rates at less than 0.25 degree per second. 

Horizon Scanner Orbit Control - Maintain 
spacecraft roll and pitch attitudes within five 
degrees of the infrared horizon sensor 
reference. Provide for manual control of the 
yaw axis. 

Rate Command Control - Maintain spacecraft 
angular rates in response to astronaut hand 
controller commands in conjunction with rate 
gyros. Maintain capsule rates within 0.1 
degree per second of the commanded rate during 
orbit and within two degrees per second second 
during re-entry. 

Manual Control - Convert attitude hand 
controller signals to continuous or discrete 
(20-millisecond) commands to the attitude 
reaction jet system. Accept maneuver hand 
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controller signals to fire the maneuver 
reaction jets continuously or for discrete 
periods (?50 milliseconds)* 

Mechanization .- The Gemini roll axis 
control diagram is shown in Figure 7 * 

Attitude error signals originating in the 
computer, inertial platform, or radar system, 
are presented to the attitude control 
electronics for summing with rate information 
from the rate gyros. Proportional attitude 
hand controller signals are also presented to 
the electronics for processing. According to 
the commanded mode, the attitude control 
electronics selects the proper input signals 
and establishes the required gains for signal 
processing. The input error signal is then 
amplified, demodulated, discriminated, and 
compared to a reference switching level. V/hen 
the error signal exceeds the reference switch- 
ing level, an ON command is sent to the 
attitude or re-entry reaction jet solenoids 
or, for translational thrusting, to the orbit 
attitude maneuver electronics. 

Power consumption in the Gemini ACHE system 
in the orbit mode, using rate gyros, is about 
one -fourth that of the Mercury system in the 
same mode. This is accomplished through the 
use of very low current circuits. For 
instance, the low hysteresis switch, which 
converts the analog attitude information into 
on-off commands to the solenoid drivers, 
operates at only three microamperes of input 


current. Hysteresis is so low in this switch 
thot special laboratory equipment is required 
to detect it. 

The Gemini control system is also capable 
of operating in the orbit mode with attitude 

signals from the horizon scanner alone, using 
pseudo-rate for damping. The system power con- 
sumption is then only three watts, l/25th that 
of the Mercury control system in the orbit mode. 
This is made possible in part by pseudo-rate 
circuitry which provides rate signals without 
the use of rate gyros and their attendant power 
consumption. Other important factors contribu- 
ting to efficient use of power are the use of 
de-energized relays in orbit mode, transis- 
torized amplifiers, switches and gain-changing 
circuits, and optimization of the power supply 
for orbit inode loads. 

The Attitude Control and Maneuver 
Electronics is required to meet extremely high 
reliability figures. For a two-week mission, 
the control system probability of success is 
0 . 99721 , and for a two-day mission, the figure 
is O.999347. To attain this kind of reliability 
the system incorporates high-reliability parts, 
extensive redundancy, and derating of all" 
components. Figure 7 shows the general areas 
of redundancy. The rate 'gyros are redundant 
and can be individually selected by axis. The 
switching amplifiers and logic are also 
redundant and can be individually selected. 
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Figure 7 « Gemini Roll .Axis Control Diagram 























Figure 8 shows the maneuver on-off logic and 
the redundant reaction jet solenoid drivers. 
These can be selected on a primary or 
secondary basis. 



Figure 8. Gemini Maneuver On-Off Logic 

In spite of the redundant circuitry and 
increased capabilities of the Gemini control 
system, the entire ACME weighs only 37 pounds 
compared to 52 pounds for the Mercury control 
system. 

This light weight is made possibly by use 

of: 

1. Magnesium for the power inverter and 
rate gyro package castings. 

2. Minimum gage sheet metal as determined 
by extensive stress analysis. 

3. Miniature components assembled into 
"cordwood"-type welded modules. 


design not only provides extensive heat 
conducting paths, but also affords a rigid 
truss-like structure for vibration resistance. 

Each electronic module card is coated with 
an epoxy compound for protection against high 
humidity and salt fog atmosphere. 

Maintainability .- Maintenance problems are 
greatly simplified in the Gemini control 
system. All adjustments, alignments, and 
calibrations are permanently accomplished at 
the factory. Complete interchangeability of 
all removable parts, sub-assemblies, and 
components is assured. Vehicle maintainability 
is also improved. The Mercury equipment is 
installed in layers within the one-man 
compartment, while the Gemini equipment is 
housed in bays around the outside of the 
vehicle. The increased ease of checkout and 
equipment maintenance places manned space- 
flight on more of an operational basis with 
advantage to both military and r on-military 
applications . 



4. Potting compound used only in 
electronic modules requiring special thermal 
considerations . 

5. Solid-state switching in all signal 
circuits . 


Legend: 1. Chassis— extruded aluminum 

channels with welded end caps 


2. Aluminum plug-in relay board 

3. Capsule coldplate (under chassis) 


Environmental Factors .- Since the ACME 
equipment is not located inside the crew 
compartment, as in Mercury, operation is 
required in a vacuum environment. Circulating 
fluid heat exchangers, or coldplates, are 
provided for equipment mounting. Two 
approaches were used for thermal design: In 

the attitude control electronics package, it 
was possible to sort out the piece-parts 
generating most of the heat and mount them 
on the chassis for conduction of the heat to 
the coldplate. The remaining piece-parts are 
mounted on epoxy cards since they have such 
low heat dissipation that infrared radiant 
heat transfer to the package walls is adequate. 
In the orbit attitude and maneuver electron- 
ics, inverter, and rate gyro packages, all 
significant heat generating piece-parts are 
chassis-mounted. Figure 9 shows the method of 
mounting switching transistors on the aluminum 
channels and the broad base used for maximum 
coldplate mounting surface. 

The use of aluminum channel chassis 


4. Redundant output switching 
transistors 

5. Redundant maneuver solenoid 
switching relays 

Figure 9» Gemini Orbit Attitude and Maneuver 
Electronics 

X-20 (Dyna-Soar) Flight Control Subsystem 
Electronics 

The X-20 (Dyna-Soar) manned orbital re- 
entry vehicle is designed for research of 
lifting re-entry and equilibrium glide flight 
problems. The X-20 flight control subsystem 
electronics is being produced by Honeywell 
under contract from The Boeing Company for the 
Air Force. 

Functional Requirements .- The X-20 delta- 
winged orbital glider must be able to re-enter 
the atmosphere and land at any suitable air- 
field chosen by the pilot within a circle of 




maneuverability over a thousand miles in 
diameter. Its range of speeds extends from 
over 15,000 miles an hour in orbit down to a 
landing speed of less than that of some of our 
present combat aircraft. 

The self-adaptive concept of flight control 
is being used in the X— 20 because of the widely 
varying flight conditions encountered during 
its mission. The direct forerunner of the X-20 
control concept is the self-adaptive flight 
control system which has been proven in the No. 
5 X-15 vehicle. Gince the X-15 and X-20 must 
function both as aircraft and as spacecraft, 
many of their design problems are similar. 

The self-adaptive control system for each 
vehicle results in uniformly satisfactory 
performance over an extremely wide range of 
flight conditions without dependence upon air 
data scheduling of system gains. 

The flight control subsystem is composed of 
rate and acceleration measuring devices, 
computing electronics, and control element 
driving devices to (l) augment the glider* s 
natural aerodynamic stability, (2) compensate 
for undesirable control characteristics, 

(5) control the glider through pilot or 
guidance system commands, and (4) keep the 
forces acting on the glider within tolerable 
limits. 

Mechanization .- The X-20 flight control 
electronics is actually three separate systems, 
one controlling each of the aircraft axes. The 
pitch axis is illustrated in functional form in 
Figure 10. This diagram shows the way input 
and feedback signals, sensed on the left, are 


combined, shaped and used to drive the three 
control elements on the right. Inputs to the 
system come from three sources: pilot stick 
commands, vehicle motion sensed by gyros and an 
accelerometer, and angle-of-attack commands 
from the inertial guidance system. These 
signals drive three control elements: the 
elevon surfaces, a servo-driven rocket nozzle 
set, and the reaction control jets. 


The pilot has four modes of flight control 
operation available to him: 

Manual-Direct - In the manual-direct mode, 
the pilot uses his control stick to command 
vehicle movement through the flight control 
electronics. He may command control surface 
position, rocket motor thrust vector position, 
or reaction control operation. No augmentation 
is provided in the manual-direct mode. 

Pilot-Selectable Gain - In this mode the 
three-axis stability augmentation system is 
activated in place of the manual-direct control. 
The augmentation system controls the aero- 
dynamic surfaces, rocket motor thrust vector, 
and reaction jets in response to gyro and 
accelerometer commands. Pilot command provides 
commanded aircraft rate for stick displacement 
instead of commanded control movement for stick 
displacement as in the manual-direct mode. The 
system loop gains are selected by the pilot for 
the Mach range through which he is flying. 

Manual -Augment - The manual-augment mode is 
identical to the pilot-selectable gain mode 
except that the system loop gains are auto- 



Figure 10. X-20 Pitch Axis Control Diagram 


146 












matically computed by the flight control 
electronics instead of being selected by the 
pilot. (The Honeywell self-adaptive concept 
used for this is described in reference 4« 


Automatic - The automatic mode is identical 
to manual-augment except that outer-loop 
signals are accepted from the inertial guidance 
system to control angle of attack, sideslip 
angle, and roll angle. These three parameters 
are programmed for an automatic re-entry, and 
the flight control electronics automatically 
directs the vehicle to follow the programmed 
guidance system commands. 

The command signal limiter (see Figure 10 ) 
is designed to limit the pitch commands from 
the guidance system or pilot* s stick to values 
which will not endanger the vehicle. 

Extremely high mission reliability is a 
requirement of the X-20. The flight control 
electronics must have a 50,000-hour raean-time- 
between-failure for a two-hour -mission in the 
manual-augment mode. In addition, neither 
manual nor augmented performance shall be lost 
by a single failure. No component replacement 
is permitted in flight. 

The high flight control reliability is 
achieved by the combined techniques of 
redundancy, monitoring, and crossfeeding. The 
flight control redundancy is based on two 
ground rules: 

1. The system will tolerate any single 


failure without loss of function or 
performance. 

2. The system will automatically disengage 
itself as a result of any second failure which 
can cause a dangerous condition. 

Figure 11 shows that the control system 
sensors and servos are each dual redundant 
while the electronics is triple redundant. The 
dual sensor outputs are monitored and then 
crossfed to the system electronics, and the 
outputs of the electronic channels are 
monitored and then crossfed to the servo 
amplifiers. The dual-redundant servo loops 
are monitored and the primary servo loop 
operates the control actuator under normal 
conditions while the secondary servo loop 
remains on standby. 

Under the above ground rules, it was 
necessary to make the system electronics 
triple redundant. During normal operation the 
electronics output may he positive hardover, 
negative hardover, or any value between. 
Therefore, if one electronic channel fails, 
it will not have an output unique to a 
failure. A voting mechanism, or monitor, 
determines which channel differs from the 
other two and disengages that channel. This 
satisfies the first ground rule. If either of 
the remaining channels fails, the voting 
monitor senses a disagreement between the two 
channels and disengages the axis of control. 
This satisfies the second ground rule. 

Dual redundancy is provided for the sensors 



Figure 11. X-20 Pitch Axis Redundancy Mechanization 































because unique indications of sensor failures, 
such as a gyro open or hardove •, can be 
monitored. A spinmotor rotation detector is 
also provided to detect gyro motor failures. 

The servo system is also dual redundant, 
but the failure detection monitor employs a 
triple channel arrangement similar to that 
described for the system electronics. The 
monitor contains a servo-loop model which is an 
electronic analog of the other two loops. By 
comparin ’ the outputs of the primary and 
secondary servo loops, and also the output of 
the servo model, the monitor detects which of 
the channels has sustained a failure. A 
failure of the primary loop results in 
transfer of control to the secondary loop. 

The adaptive system uses transistor 
differential d-c amplifiers as the basic 
electronic building blocks in summing 
amplifiers, active filters, and various other 
functions. These d-c amplifiers are about one- 
half the size and weight of a comparable 
magnetic amplifier and have better gain, band- 
width, and drift characteristics. Extremely 
low drift rates are obtained by using high 
reliability, matched transistor pairs manu- 
factured from a single silicon chip. 

Environmental factors .- Because the flight 
control computer (Figure 12) is hard-mounted 
and subjected to high vibration levels, special 
care has been taken to ensure a rugged design. 
The chassis is a formed, half-hard aluminum 
shell with side covers of honeycomb aluminum 
sandwich material to provide structural 
stiffening at a minimum weight penalty. The 
internal shelves and structural members are 
half-hard aluminum sheet. The front side of 
the chassis contains 79 plng-in electronic 
circuit cards, while the hard-mounted 
components - pov/er supply transformers, relay 
cartridges, and bench level test connectors - 
are accessible from the rear side. 

The circuit cards slide into the shelves 
between nylon guides and engage the mating 
connector at the rear of the card pocket. Each 
card is firmly held in position at its four 
edges: top and bottom by the nylon card guides, 
at the rear by the card connector, and at the 
front by silicone rubber bumpers attached to 
the chassis side cover. The rubber bumpers 
provide a positive pressure on the card to 
ensure reliable connector mating. 


level of the computer. The coolant is 
discharged through the screened air vents near 
the top of the computer. The configuration of 
the card assemblies within the chassis offers 
a chimney effect to facilitate the coolant 
flow. The air inlet holes in the bottom of 
the chassis as well as the air passage holes 
in the shelves of the computer are located for 
maximum utilization of the coolant. Under 
emergency conditions without coolant, the 
computer is capable of operating for two hours 
with only slight degradation of performance by 
using the chassis and mounts as heat sinks. 



2. Redundant connectors 

3. Plug-in electronics 

4 . Nylon circuit card guide 

5. VZelded electronic modules 

6. Air inlet holes 


The plug-in cards are approximately four 
inches square and contain potted assemblies, 
cordwood-packaged unpotted assemblies, and 
individual components mounted on printed 
circuit cards. In general, each card is 
associated with a specific function: One card 

contains four servo amplifiers, another four 
demod amplifiers, and so on. This grouping of 
functions creates system flexibility by 
allowing easier incorporation of design 
changes . 


7. Air passage holes 

8. All circuits at least dual 
redundant 

9. Dual beam chassis construction 
with welded shelves and 
stringers; honeycomb aluminum 
cover bolted to chassis for 
rigidity. 

Figure 12. X-20 Flight Control Computer 


In contrast to Mercury and Gemini, the 
primary method of heat removal from the 
computer is by forced convection. The coolant 
enters the bottom of the chassis through 
135 0 . 059 -inch diameter holes and absorbs heat 
from the components as it rises through each 
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Apollo Command Module Stabilization and 
Control System 

The complexity of factors affecting the 
Apollo Command Module Stabilisation and 
Control System (SCS) design is a direct result 
of the most ambitious mission ever attempted by 
man. The combined requirements for the multi- 
phased mission - earth orbit, translunar injec- 
tion and coasting, midcourse corrections, lunar 
orbital injection, rendezvous and docking, 
transearth injection and coasting, earth entry 
orientation, and re-entry - impose a great 
variety of design tasks. The Command Module 
SCS is being developed by Honeywell under 
contract from North American Aviation for NASA. 

Functional Requirements .- Although the 
detailed (SCS) performance requirements are too 
extensive for adequate discussion here, the 
following items indicate some of the factors 
which have been considered in the functional 
and hardware design. 

1. The SCS is actually a three-in-one 
system which must interface with Command 
Module reaction jets, Service Module reaction 
jets, and Service Module thrust vector gimbal 
actuators. Each interface requires 
compatibility matching and different performance 
requirements . 

2. The system shall be capable of 
controlling rates during limit cycle operation 
to 0.02 degree per second or less. This 
severe requirement is necessary to allow 
accurate navigational sightings and to 
conserve fuel during coast periods. 

3. The reaction system must provide both 
small amplitude limit cycle and efficient 
maneuvering operations. During maneuvering the 
SCS must provide constraints on command rates 
which will conserve fuel but will not 
compromise the maneuvering capability. 

4. Since the Apollo vehicle must be 
capable of rendezvous and docking, the SCS jet 
selection logic must provide simultaneous 
rotational and translational control. 

5. The SCS must be able to effect 
precision control of velocity corrections in 
order to meet the narrow entry window from a 
transearth trajectory at superorbital 
velocity. 

6. The Command Module i 9 a lifting 
vehicle during earth entry with a L/D ratio of 
0.5. The symmetrical shape of the capsule 
minimizes any aerodynamic cross-coupling, 
therefore greatly simplifying the entry 
stabilization problem. 


7. The Apollo earth entry problem involves 
essentially a single axis control of roll 
attitude with only rate damping required in 
pitch and yaw. In general, the Command 
Module represents an optimum design yielding 
minimum earth entry stabilization problems. 

8. The Apollo vehicle has a variable 
configuration. The SCS must perform initially 


with the Command Module .plus the Service 
Module and the Lunar Excursion Module, a 
combined weight of about 45 tons. On the final 
segment of the return trip, the vehicle consists 
of the Command Module alone at about five tons. 
The variation in vehicle configuration and fuel 
load results in a wide range of vehicle 
inertias and center of gravity positions which 
must be considered in system analysis. Fuel 
slosh and vehicle bending add to the stability 
problems • 

9. A 0.995 probability of successful SCS 
operation is desired for a 14 -day mission. 

Mechanization .- The flight control sub- 
system of the SCS contains the inertial 
sensors and electronic computer assemblies 
which provide both attitude and rate stabiliza- 
tion and control. The flight control hardware 
consists of (l) a three-axis rate gyro package, 
(2) an attitude gyro and accelerometer package 
for both three-axis attitude sensing and 
longitudinal axis g sensing, and ( 3 ) 
electronic computer assemblies for amplifica- 
tion, shaping and integration of signals, mode 
switching, jet selection logic, reaction jet 
solenoid drivers, thrust vector servo control, 
attitude reference computation, and velocity 
increment computation. 

The SCS pitch axis block diagram is given 
in Figure 13. Rate gyro signals are summed 
with limited attitude error signals to provide 
maneuver stabilization. Manual control inputs 
are introduced by summing the outputs of two 
hand-operated rotational controllers with the 
rate signal. During manual control inputs the 
attitude errors are synchronized and a rate 
response proportional to command is obtained. 
In case of a rate gyro failure, the attitude 
gyros can be operated in a rate mode if 
control is required before the rate gyro can 
be replaced. 



Figure 13 * Apollo Command Module SCS Pitch 
Axis Control 


The SCS attitude reference comprises three 
strapped-down precision integrating gyros 
specifically developed to meet Apollo 
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performance and high reliability requirements. 
The attitude gyros may be operated to provide 
three functions : 

1. For attitude hold, the gyro outputs are 
used directly as attitude error signals. 


developed which will provide positive mounting 
contact and convenient package removal by an 
astronaut rearing his pressure suit and gloves 
and working under zero g conditions. The 
hardware must also pass rigid outgassing, 
humidity, and oxidation requirements. 


2. For rate damping, the gyro output is 
fed back into the gyro torquer to provide 
immediate backup rate gyro capability. 

3. For attitude reference, the gyro out- 
puts are synchronized through a three-axis 
attitude ;yro coupling unit (AGCTJ) to provide 
Fuler angle reference information for display 
and command purposes. The outputs of the AGCU 
are compatible in reference orientation with 
the Guidance and Navigation (G and N) system 
signals. 


Attitude error signals generated by either 
the G and IT System or the SC 3 attitude gyros 
are fed through a deadband and attitude error 
limiter. The deadband provides a wide deadband 
limit cycle for the noncritical coast phases of 
the mission. During these phases a unique 
pseudo-rate feedback is used which causes limit 
cycle operation well within the extent of the 
rate gyro deadband. In addition the width of 
the deadband itself can be varied by the crew 
in order to further minimize reaction jet fuel 
consumption in those periods of the flight when 
close attitude control is not necessary. The 
attitude error limiter acts as a rate command 
limiter to conserve fuel during extensive 
automatic maneuvers. Rate signals are summed 
witn tne limited attitude error and are fed 
through the jet select logic, to the switching 
amplifier and to the reaction jet driver 
v * wnicr. provides the power to drive the 

reaction jet solenoids. 


In order to provide the Apollo crew with a 
vernier r * control u e ch a:: is for precision 
n .vigational sightings, a minimum impulse 
com ,,n& cecnnique may e© selected to cause very 
small vehicle rate changes by pulsing the 
reaction jet solenoids. 


Thrust vector control is based on a rate— 
plus-displacement technique. In this mode an 
attitude command is summed with attitude and 
fed into tne control loop. An attitude 
limiter acts as a rate command limiter, and a 
gimbal travel limiter prevents the actuator 
from running against its position stops. Prior 
to thrusting, attitude hold in all three axes 
is provided by the reaction jet system. At 
thrust initiation, the pitch and yaw control is 
transferred to the thrust vector control loops, 
and the pitch and yaw reaction systems are dis- 
abled. Roll reaction control continues 
throughout the thrusting maneuver# 


ttwironmental and Maintenance Factors .- 
Coldplate mounting of the electronics and 
sensors requires efficient thermal conduction 
paths. At the same time, the reliability 
requirement demands standby redundancy, as 
indicated in Figure 5 » which is provided by 
inflight replacement of gyros and electronic 
circuit subassemblies. To solve both the 
ooldplate mounting and maintenance problems, 
special hardware packaging designs have been 


Figure 14 shows the present approach to in- 
flight maintenance, as evidenced by the 3C3 
rate and attitude gyros and accelerometer in i 

the Command Module . The rate gyro package 
contains three orthogonally mounted rate gyros. 

Each gyro has a shroud containing an integral 1 

circuit connector. A quick-disconnect clamp- 
ing mechanism is used to secure each gyro in 
place. Each gyro and also the gyro electronic 
module is easily replaceable by an astronaut. 

Positive, accurate alignment of the .gyros to 
the spacecraft axes is assured by precision 
surfaces and clamping techniques so that no 
inflight alignment procedure is necessary. A 
color indicator at the gyro clamping device 
shows the astronaut when positive locking is 
achieved. 

The attitude gyro and accelerometer 
package contains three orthogonally mounted 
rate integrating gyros and a hinged pendulous 
accelerometer. Each sensor has a thermally 
insulated shroud with an integral connector. 

These sensors, like the rate gyros, may be 
readily replaced without alignment necessity. 

Any rate or attitude gyro may be replaced 
under shirtsleeve conditions without removing 
the mounting package from the hardware 
compartment. Even under pressure-suit condi- 
tions, the package design permits an 
astronaut to perform any necessary maintenance. 

Inflight replacement of circuits is also 
required so special consideration was given to 
the need for packaging all piece-parts 
together in a replaceable subchassis. ’Vi thin 
each subchassis, small piece-carts are 
packaged in potted, welded modules which are 
thermally connected to the subchassis. Larger 
piece-parts are mounted on brackets formed on 
the subchassis. Each subchassis is clamped in 
place in an assembly which mounts on the 
spacecraft coldplate. 

The nature of the Apollo mission demands 
that the control system design must have a high 
inherent reliability; parts must be of tested 
and proven high reliability; the techniques of 
reliability analysis must be valid; and quality 
control must be rigorous. In addition all 
parts must tolerate long exposure to high 
humidity and 100 per cent oxygen without any 
change in characteristics or release of toxic 
fumes. To obtain the required reliability and 
still keep onboard spares at a minimum, it is 
necessary to use parts v/hich in many cases 
exceed Minut email standards. The use of such 
parts assures the highest inherent reliability. 

Reliability beyond this level is a direct 
result of reliability and design teamwork 
throughout the system development process. The 
value of this factor to control system 
performance is of the highest importance in 
manned space programs. 
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Legend 

1. Rate gyro package 

2. Spacecraft coldplate 

3. Package mounting plate 

4. Package clamp 

5- Removable attitude gyros (accelerometer 
at rear 

6. quick disconnect gyro clamp and indicator 
7- Package clamp 

8. Attitude gyro and accelerometer package 

9. Interface connector jackscrews 

10. Accelerometer elapsed time indicator 

11. Gyros elapsed time indicator 

12. thermally insulated gyro shroud and 
integral connector 

13. Spacecraft wiring channel 

14. Removable rate gyros 

15. Removable electronics 

16. Elapsed time indicator 


Figure 14* Apollo Command Module SCS Inertial Sensors 
in Mounting Compartment (Conceptual View) 


Manned Orbiting Space Stations 

The primary factors affecting design of a 
control system for a manned orbiting space- 
station naturally result from definition of the 
configuration and the mission requirements. At 
this time no specific mission requirements have 
been defined for manned orbiting space stations 
and hence no unique configuration has been 
developed. However, considerable effort has 
been expended in studying possible mission 
requirements and applicable configuration 
designs. Of the basic configurations, four 
specific concepts have received the most 
attention. These are illustrated in Figure 15: 
A Rotating hexagonal wheel or radial element 
configur action providing a simulated gravity 
effect in the rotating areas and a zero-g 
laboratory in the nonrotating hub; a non- 
rotating cylindrical configuration providing 
zero-g conditions; and a spinning dumbbell 
configuration consisting of a living module 
connected to a counterbalancing mass by cable 
or semirigid tube. Much of the material dis- 
cussed below is based on the results of a 
recent joint North American Aviation- 
Honeywell study. 



Figure 15. Manned Orbiting Space Station 
Conf igurations 
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Control System Restraints .- For any space 
station configuration, the major factors 
affecting control system design stem from 
operational considerations , such as one to five 
year life, onboard maintenance requirements, 
and orientation tov/ard the sun for efficient 
utilization of solar energy. In addition, a 
space station would probably require periodic 
resupply of food, propellant, and other 
expendable items. This would be provided by a 
manned or unmanned resupply vehicle which would 
rendezvous with the station and dock for equip- 
ment transfer. 

The above factors combine to impose 
restraints on control system design such as: 

1. Reaction jet systems must be designed 
so that no hazard is introduced by transfer- 
ring hypergolic propellant components in the 
resupply operation. Preferably, a complete 
self-contained system would be transferred from 
the resupply vehicle and automatically affixed 
to the outside of the station. 

2. Inasmuch as the basic purpose of the 
personnel aboard is to conduct experiments, 
vehicle control should be completely automatic. 
Personnel would serve as monitors of system 
operation but must also have the authority and 
provisions to assume complete control when 
desired or in the event of system malfunction. 

3* If a space station is to be developed 
in the near future, it is probable that solar 
cells would be used as a source of energy and 
this would require that one station axis be 
continuously directed at the sun. 

4* In each space station configuration, 
the size of control elements becomes a 
significant parameter in studying control 
system mechanization. For example, a large 
station may require control moment gyros. five 
feet in diameter with an angular momentum of 
30,000 slugs-feet per second. 

5. Very few existing control elements can 
be expected to perform without wearout failure 
for a three to five year period. Gyros, 
accelerometers, reaction jets, and any 
element with moving parts must be designed so 
that ready replacement can be effective in 
event of failure. System modules must be 
designed so that spares can be transferred to 
the station and installed under zero g 
environment . 


axes will be necessary. Attitude control in 
either two or three axes, depending on the 
requirements for solar- orientation and antenna 
pointing, must be provided. In addition, 
command control of an unmanned resupply vehicle 
may be necessary for rendezvous and docking. 


For spinning configurations , some new 
approach to control logic and control element 
utilization may be anticipated. For example, 
consider the modes of motion of a spinning 
vehicle (Figure 16): 





Figure 16* Space Station Modes of Motion 

Correct Mode - The body reference axis and 
the spin axis coincide. 


Robbie Mode - There are several equivalent 
definitions and characterizations of this mode 
of motion. The simplest form of wobble is the 
response of a radially symmetric spinning 
station to an impulsive torque. If the motion 
is undamped, the "tip” of the reference axis 
travels at a fixed rate and describes a 
"circle" in inertial space. Body rates arid 
angular accelerations vary in a cyclic manner, 
and sensors measuring orientation show an 
error of either constant or cyclically varying 
amplitude depending upon the body*s mean 
orientation. Robbie can be damped by reaction 
jets or, more efficiently, by momentum 
exchange devices such as reaction wheels or 
control moment gyros. 


6. Any maintenance which the crew could 
be expected to perform must be carefully 
considered in the design of tools and 

c omponent packaging . 

7. Efficient management of energy dissi- 
pation for orientation control and rate damp- 
ing will be a primary restraint on control 
system design and may be a more significant 
parameter than system weight. 

Performance Requirements .- Control system 
performance requirements for the nonspinning 
zero gravity laboratory will not be signifi- 
cantly different from requirements for other 
space vehicles. Rate damping about three 


Apparent Coning Mode - Hass imbalance out 
of the station spin plane causes a misalignment 
of the spin axis and the body reference axis. 
The "tip" of the reference axis travels at a 
fixed rate and describes a "circle" in 
inertial space as it does in simple wobble. 
However, the rate is always the station spin 
rate, all body angular accelerations are zero, 
and all body rates are constant. Momentum 
exchange devices can very effectively 
counteract out-of-plane mass imbalance. 

Circling Mode - Mass imbalance in the 
station spin plane causes spin about an axis 
parallel to but not coincident with the body 
reference axis. This is a difficult mode to 
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sense "because it produces no inputs to gyro and 
celestial orientation type of sensors* Body 
rate about the reference is constant, the other 
rates are zero, and all "body angular 
accelerations are zero* Circling can be 
eliminated by deployment of station masses to 
put the center of mass on the reference axis. 

Vehicle attitude must be controlled by 
orientation of the spin axis* Reaction jets 
or magnetic torquers are most effective in this 
role. Reaction wheels are not effective in 
control of attitude, but would provide effi- 
cient control of apparent coning and wobble 
damping. Control moment gyros could be used in 
place of reaction wheels. 

For both spinning and non-spinning config- 
urations, the most significant source of 
external disturbance torques will probably 
result from gravity gradient across the 
station. This torque results from the fact 
that the configurations are not symmetric and 
the differences in the principal moments of 
inertia will be fairly large. In order to 
control attitude against the influence of the 
gravity gradient torque, a significant amount 
of energy will be required. If reaction jets 
are used to supply this energy, approximately 
1000 pounds of fuel per month could be 
expended for some configurations. The 
character of the torque is such that it can be 
effectively unidirectional for periods as long 
as 40 to 50 days. The influence can be a 
significant factor in control system design. 

Dual if ic at ion~Te sting .- A final considera- 
tion which must influence system design is that 
the character of the system and size of the 
control elements may require a new philosophy 
of system qualification testing. For some 
space stations being considered, it would be 
impractical to develop a full scale space 
station simulation to check out and qualify 
the control system in the manner used for the 
development of present systems. Lack of a 
zero gravity test environment and the large 
size of possible control elements required will 
complicate the design of adequate tests, and 
this factor must be considered in the initial 
stage of system design. 

Speculation on the Future 

Speculation on the future of a technology 
advancing as rapidly as that of spacecraft 
design is about as risky as trying to guess as 
to which way a woman driver is going to turn. 
There are however, a few observations which, 
at least at present, seem fairly safe. 

For future vehicles it is likely that the 
weight and volume of stabilization and control 
equipment (with the possible exception of 
reaction jet tankage) will become a minor 
factor while the stronger emphasis will be 
placed on high reliability and adequate 
performance. This statement is made because 
future control equipment will inevitably 
become considerably smaller and lighter due to 
the increased use of microminiature 
electronics. At the same time it is likely 
that vehicle weight will increase particularly 
for scientific exploration vehicles, at least 


to the level represented by the Apollo 
translunar vehicle. The cost of the control 
system for scientific exploration vehicles 
will probably be of secondary importance 
because it, like the weight, will be quite 
negligible compared to the cost of the entire 
vehicle. These circumstances will allow 
control system designers much greater freedom 
in choosing the functions to be included and 
the mechanization by which the function will 
be accomplished. 

It is very probable that digital 
mechanization will play an important part in 
future space vehicle control, and in fact the 
identifiable separate control elements may be 
reduced to sensors and torque producing 
devices with all computation and signal 
shaping taking place in a central digital 
computer. For this millenium to be attained 
one certain requirement is the development of 
digital computers with the required long-time 
reliability. 

It also seems probable that a requirement 
will arise for space vehicles of a totally 
different type from the exploration vehicles. 
These will be military vehicles, perhaps of 
a satellite inspector or an interceptor type. 
These vehicles would necessarily be as small 
as possible in order to minimize launch cost. 
They should ideally of course also be as 
simple as possible, yet it seems probable that 
an operational military vehicle would have to 
have the ability to reach a reasonable choice 
of landing sites and thus will have to be of 
the lifting re-entry type. Again from an 
operational viewpoint such vehicles would need 
some form of automatic energy management systen 
associated with the basic control system. This 
class of vehicles would probably present 
control problems somewhat similar to those now 
facing the designers of equipment for high- 
performance military airplanes, namely, a 
conflict between reliability and the required 
functional complexity, a conflict between cost 
and both reliability and performance, and 
finally one problem (familiar to those who have 
worked with manned aircraft control . systems ) 
providing handling qualities that will please 
all the pilots. 
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